[Bug binutils/24235] New: objdump: Read memory violation in libbfd.c

[spinpx at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=24235

            Bug ID: 24235
           Summary: objdump: Read memory violation in libbfd.c
           Product: binutils
           Version: 2.33 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: spinpx at gmail dot com
  Target Milestone: ---

Created attachment 11617
  --> https://sourceware.org/bugzilla/attachment.cgi?id=11617&action=edit
the input triggers the bug

- Intel Xeon Gold 5118 processors and 256 GB memory
- Linux n18-065-139 4.19.0-1-amd64 #1 SMP Debian 4.19.12-1 (2018-12-22) x86_64
GNU/Linux
- clang version 4.0.0 (tags/RELEASE_400/final)
- version: commit c72e75a64030b0f6535a80481f37968ad55c333a (Feb 19 2019)
- run objdump -x input_file

- asan report
==1161627==ERROR: AddressSanitizer: SEGV on unknown address 0x613000bbe0fe (pc
0x000000607197 bp 0x7ffcfa7de560 sp 0x7ffcfa7de500 T0)
==1161627==The signal is caused by a READ memory access.
    #0 0x607196 in bfd_getl32
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/bfd/libbfd.c:695:7
    #1 0x896b30 in pex64_get_runtime_function
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/bfd/pei-x86_64.c:94:26
    #2 0x88f222 in pex64_bfd_print_pdata_section
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/bfd/pei-x86_64.c:730:5
    #3 0x88d555 in pex64_bfd_print_pdata
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/bfd/pei-x86_64.c:794:12
    #4 0x8c3894 in _bfd_pex64_print_private_bfd_data_common
/mnt/raid/user/chenpeng/FuzzingBench/build/asan/binutils-gdb/bfd/pex64igen.c:2911:5
    #5 0x895d94 in pe_print_private_bfd_data
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/bfd/peicode.h:336:8
    #6 0x4f65d5 in dump_bfd_private_header
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/binutils/objdump.c:3181:3
    #7 0x4f51f9 in dump_bfd
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/binutils/objdump.c:3782:5
    #8 0x4f4c71 in display_object_bfd
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/binutils/objdump.c:3883:7
    #9 0x4f4b67 in display_any_bfd
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/binutils/objdump.c:3973:5
    #10 0x4f424a in display_file
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/binutils/objdump.c:3994:3
    #11 0x4f3ab0 in main
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/binutils/objdump.c:4304:6
    #12 0x7f659f6c409a in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
    #13 0x41d639 in _start
(/mnt/raid/user/chenpeng/FuzzingBench/build/asan/install/bin/objdump+0x41d639)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/mnt/raid/user/chenpeng/FuzzingBench/binutils/binutils-gdb/bfd/libbfd.c:695:7
in bfd_getl32
==1161627==ABORTING


- Exploitable
Description: Access violation on source operand
Short description: SourceAv (19/22)
Hash: bafff732c614888210a0d11ed0439a22.5360e10ba1488dec3bada789cf815760
Exploitability Classification: UNKNOWN
"Explanation: The target crashed on an access violation at an address matching
the source operand of the current instruction. This likely indicates a read
access violation.
Other tags: AccessViolation (21/22)

-- 
You are receiving this mail because:
You are on the CC list for the bug.